Tailored for professionals aiming to enhance their security efficiency, this course combines theoretical knowledge with practical demonstrations, providing attendees with the critical skills needed to orchestrate security responses in today’s evolving cyber environment.




Cortex XSOAR: Automation and Orchestration (EDU-380)

The course participants will delve into setting up integrations, designing tasks, creating playbooks, and constructing efficient incident layouts for better triage and investigation.

It covers categorizing event data, developing automations, managing indicators, and organizing user roles, all aimed at improving security operations. Designed for professionals focused on advancing security efficiency, this training blends theory with hands-on demos, equipping attendees with essential skills for orchestrating security responses in today’s dynamic cyber environment.


Before attending, participants should finish the Cortex XSOAR Analyst digital learning module. Those with a background in scripting, especially in Python and JavaScript, and familiarity with JSON data objects, may find it easier to assimilate the course content. Nonetheless, the ability to write code is not a prerequisite for completing the course.


Level: Advanced

Duration: 4 Days

Format: Instructor-Led Training

Supported Platforms: Cortex XSOAR

Target Audience

The course is ideal for Security Operations (SecOps) personnel, Security Orchestration, Automation, and Response (SOAR) engineers, Managed Security Service Providers (MSSPs), Service Delivery Partners, System Integrators, and Professional Services Engineers.

Best Practices

As an Authorized Training Partner, Datacipher is renowned for its superior training programs. Our trainers are more than educators; they are seasoned experts and security consultants who engage daily with Palo Alto Networks solutions, particularly Cortex XSOAR. They leverage their extensive practical experience to enrich the course, focusing on the tangible application of automation and orchestration principles.




Can the EDU-380 course be taken online?

Absolutely. Our online training is led by expert instructors using web conferencing tools, official materials, whiteboarding, and live demos. Participants also access personal labs for practical experience.

Is in-person classroom training available?

Yes, we host in-person classes at our facilities and offer customized on-site training. Check our “Price and Dates” section or contact us for details.

Will I get official course materials?

Participants receive official course materials in electronic or printed form, including detailed slides and recordings of the training sessions. For printed materials, ensure booking is confirmed at least ten days in advance.

Can I print the electronic coursebook?

Yes, the electronic coursebook is printable, offering flexible study options.

Do participants receive a certificate of completion?

Upon completion, participants receive an official Palo Alto Networks certificate, acknowledging their achievement.

Exam Resources


Credits Guide

Credits Datasheet

Credits FAQ

Course Outline

Module 1 – Cortex XSOAR Functionality and Feature Sets
Module 2 – XSOAR Integrations
Module 3 – Playbooks
Module 4 – Classification and Mapping
Module 5 – Layout Builder
Module 6 – Solution Architecture
Module 7 – Docker
Module 8 – Automation Development & Debugging
Module 10 – Indicators and Threat Intelligence Management
Module 11 – Jobs and Job Scheduling
Module 12 – Users and Role-Based Access Controls (RBAC)
  • Select Time Zone
    Americas Date and Time
    Asia Date and Time
    Europe Date and Time

Training Credits/Participant: 40

Payment Methods

At DataCipher, we provide a range of payment options for our Palo Alto courses. Here’s what you can choose from:

Palo Alto Networks Training Credits and Vouchers – We accept both training credits and training vouchers issued by Palo Alto Networks. To enroll in a course using your credits or vouchers, please click the Register button. You’ll have the opportunity to apply these credits during the final step of the registration process.

Purchase Order (PO) – If your organization prefers using a purchase order, begin the registration by clicking the Register button. At the conclusion of the registration form, choose the option “My company will pay for it, please send an invoice with the payment details.” Our training team will then provide an official quote and any necessary additional information that your accounts department might need to issue the PO.

Bank Transfer – DataCipher maintains bank accounts in both the US and Europe, accommodating all standard bank transfer methods such as IBAN/BIC, Swift, ACH, or wire transfer. To make a payment via bank transfer, simply use the Register button to sign up for your selected course.

Credit Card Payments – We accept payments from all major credit cards, including Mastercard, VISA, American Express, Discover & Diners, and Cartes Bancaires. Payments can be made directly through the registration link or by requesting an invoice that includes a web link for online payment. All transactions are secure, and DataCipher does not store any credit card information.

These methods are designed to make the registration process as smooth and flexible as possible for all participants.


Guaranteed to Run – DataCipher is committed to running this class unless unforeseen events such as an instructor’s accident or illness occur.

Guaranteed on Next Booking – The course will proceed once an additional student registers.

Scheduled Class – We have scheduled this course and rarely cancel due to low enrollment. We offer a “Cancel No More Than Once” guarantee, ensuring that if a class is canceled due to insufficient enrollment, the next session will run regardless of the number of attendees.

Sold Out – If the class is fully booked, please use our contact form to join the waiting list or to inquire about additional sessions. We’re here to accommodate your training needs and keep you informed of new opportunities.

Half and Full-Day Training

At DataCipher, we offer our training courses in both traditional full-day and convenient half-day formats. Our half-day classes are specifically designed for IT professionals who cannot be away from their workplaces for consecutive full days. This flexible schedule allows participants to dedicate a few hours to learning and then return to their regular work responsibilities.

The curriculum for both the full-day and half-day formats is identical. The primary difference is that the half-day classes spread the coursework over a more extended period, providing a balanced approach to professional education. DataCipher has been successfully running these half-day training sessions for several years, receiving consistently positive feedback from our customers. They appreciate the flexibility and report that the extended timeframe facilitates a deeper understanding of the material, as it gives them more time to absorb and reflect on the information learned.

Upon completing the intensive EDU-380 course on Cortex XSOAR: Automation and Orchestration, participants will emerge with a comprehensive understanding of setting up integrations, task design, playbook creation, and the development of effective incident layouts for improved triage and investigation processes.



Become An Expert By Practice – Get Your Hands On Labs

Don’t let your tech outpace the skills of your people


Dedicated to excellence, we cultivate strong partnerships with worldwide technology innovators.


What Our Clients Say